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DETAILED ACTION 

1. Claims 1-12 are pending in the application. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

2. Claims 1-12 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Bonehet al. (U.S. Patent 7,113,594 B2) hereinafter Boneh in view of Rivest, Shamir 
and Tauman (How to leak a secret, Advances in Cryptology-Asiacrypt 2001, LNCS 
2248. pp.552-565, Springer-Verlag, 2001) hereinafter Rivest. 

Regarding Claims 1 and 11, Boneh discloses a method for generating an 
identity-based ring signature by using bilinear pairings, in a cryptosystem that includes a 
user (receiver), a signer (sender) and a trusted authority (PKG 1003), which comprises 
the steps of: 

at the trusted authority generating a set of system parameters (Parameters) 
shared by the user and the signer and storing the set of system parameters in a 
memory of each of the user and the signer (Abstract; Figure 10, col. 30, lines 17-28); 
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at the trusted authority, generating a public key and a private key for the user and 
the signer by using the set of system parameters, thereby transmitting the generated 
public and the private keys to the user and the signer through a secure channel, 
respectively (Figure 2, elements 220, 230, and 240, col. 15, lines 45-54); 

at the user, concealing content of a message (col. 26, lines 28-40). 

Boneh explicitly does not disclose "requesting a ring signature for the content- 
concealed message to the signer; at the signer, producing the ring signature based on 
identity (ID) of the user, thereby forming an ID-based ring signature for the content- 
concealed message; and at the user, verifying validity of the ID-based ring signature." 

However, RSA discloses requesting a ring signature for the content-concealed 
message to the signer (Abstract, page 552); at the signer, producing the ring signature 
based on identity (ID) of the user, thereby forming an ID-based ring signature for the 
content-concealed message (pages 559-560); and at the user, verifying validity of the 
ID-based ring signature (pages 560-561). 

Therefore, it would have been obvious to one of ordinary skill in the art at the 
time the invention was made to have incorporated Rivesf s reference within Boneh to 
include requesting a ring signature for the content-concealed message to the signer; at 
the signer, producing the ring signature based on identity (ID) of the user, thereby 
forming an ID-based ring signature for the content-concealed message; and at the user, 
verifying validity of the ID-based ring signature. One of ordinary skill in the art would 
have been motivated to specify a set of possible signers without revealing which 
member actually produced the signature (Rivest, Abtract). 
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Regarding Claim 2, Boneh and Rivest disclose the limitations of Claim 1 above. 
Boneh further discloses wherein the step (a) includes the steps of: (a1) introducing a 
cyclic group G of an order q by means of a generator P, wherein the cyclic group G is 
an elliptic or hyper-elliptic curve Jacobian; (a2) producing a multiplicative cyclic group V 
of the order q by using a bilinear pairing e expressed as the following Equation: e: G*G- 
>V (a3) determining cryptographic hash functions H: [0.1]*->Zq* and H1: {0,1}*->G; 
wherein Zq* is a multiplicative cyclic group corresponding to V; and (a4) selecting a 
master key s of the trusted authority and preparing a public key Ppub of the trusted 
authority by using the master key s and the generator P by using the following Equation 
Ppub=s.P (Figures 3-4 and 7, col. 5, line 60 through col. 6, line 56). 

Regarding Claim 3, Boneh and Rivest disclose the limitations of Claim 2 above. 
Boneh further discloses wherein the set of system parameters has G, q, Ppub, P, H 
and HI (col. 3, lines 30-45). 

Regarding Claim 4, Boneh and Rivest A disclose the limitations of Claim 3 
above. Boneh further discloses wherein the public key QIDi and the private key SIDi of 
the user are stored in a memory of the user, which are defined by using the following 
Equations: QIDi=H1(IDi) and SIDi=s.QIDi where IDi is the user's identity, i being a user 
index which is an integer ranging from 1 to n (col. 6, lines 25-45). 
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Regarding Claim 5. Boneh and Rivest disclose the limitations of Claim 4 above. 
Rivest further discloses wherein the step (d) includes the steps of: (d1) selecting an ID 
list L, wherein L is a set of identities of users; (d2) extracting a random element A of the 
cyclic group G, thereby computing an initial signature value by using the ID list L; (d3) 
choosing a random value of the cyclic group, thereby computing additional signature 
values by using the ID list L; (d4) generating a ring signature value by using the private 
key of the signer; (d5) fomning a ring of ring signature values by selecting zero as a 
glue value of the additional signature values; and (d6) storing in a memory of the user 
the ID-based ring signature of n+1 ring signature values (pages 552-565). 

Regarding Claim 6, Boneh and Rivest disclose the limitations of Claim 5 above. 
Boneh further discloses wherein, at the signer, the initial signature value, ck+1, is 
computed by using the following Equation: ck+1=H (L|| m || e(A, P)), wherein k is a 
signer index and m is the content-concealed message (Abstract, col. 4, lines 15-30). 

Regarding Claim 7, Boneh and Rivest disclose the limitations of Claim 6 above. 
Boneh further discloses wherein an additional signature value is computed by using the 
following Equation: ci+1=H(L|| m || e(Ti, P)e(ciH1(IDi), Ppub)) for "i" corresponding to 
one of values of all modulo n (k+l , . . . , n-1, 0, 1 and k-1), and then stored in a 
memory of the signer wherein Ti is the random value of the cyclic group G (col. 29, 
lines 1-10). 
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Regarding Claim 8, Boneh and Rivest disclose the limitations of Claim 7 above. 
Boneh further discloses wherein the ring signature value, Tk, is calculated by using the 
following Equation: Tk=A-ckSIDk; and stored in a memory of the signer (Figures 10-12, 
elements 1106, 1107, col. 30, line 1 through col. 33, line 4). 

Regarding Claim 9, Boneh and Rivest disclose the limitations of Claim 8 above. 
Boneh further discloses wherein the ID-based ring signature is a sequence (cO, TO, T1, 
. . . , Tn-1), which is stored in a memory of the user (Figures 10-12, elements 1106, 
1107). 

Regarding Claim 10, Boneh and Rivest disclose the limitations of Claim 9 above. 
Rivest further discloses wherein the validity of the ID-based ring signature is 
determined by using the following Equations: 

ck+1=H(L||m|| e(A.P)) 

ck + 2 = H(L|| mil e(Tk + 1,P)e(ck+1H1(IDk + 1),Ppub)) 

cn = H(L||m||e(Tn-1,P)e(cn-1H1(IDn-1),Ppub)) 

c1=H(L||m||e(TO,P)e(cOH1(IDO),Ppub)) 

c 2 = H ( L II m II e ( T 1 , P ) e ( c 1 H 1 ( ID 1 ) , P pub ) ) 

ck = H(L||ml|e(Tk-1,P)e(ck-1H1(IDk-1),Ppub)) 

wherein if i=0, 1 n-1 and cn=cO, then the ID-based ring signature is determined 

to be valid; and if otherwise, the ID-based ring signature is rejected (pages 552-565). 
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Regarding Claim 12, Boneh and Rivest disclose the limitations of Claim 1 1 
above. Boneh and Rivest further disclose the system parameters includes:a cyclic 
group G; G's order q; G's generator P; the trusted authority's public key Ppub described 
by Ppub=s.P, where s is the master key (Figures 3-4 and 7, col. 5, line 60 through col. 
6, line 56 of Boneh); and 

hash functions H and H1 described by H: {0,1}->Zq* and HI: {0,1}->G, where Zq* 
is a cyclic multiplicative group, wherein the bilinear pairings e are defined by e: G*G- 
>V, where V is a cyclic multiplicative group of the order q and uses cyclic multiplicative 
group Zq* (col. 3, lines 30-45 of Boneh), 

the user's public key QIDi is described by QIDi=H1(IDi), where IDi is the user's 
identity, i being a user index which is an integer ranging from 1 to n, the user's private 
key SIDi is described by SIDi=s.QIDi (col. 6, lines 25-45 of Boneh), 

the initial signature value is computed by ck+1=H(L ||m || e (A, P)), where k is a 
signer index, L is a set of identities of users, m is a content-concealed message to be 
ring-signed and A is a random element of the cyclic group G (Abstract, col. 4, lines 15- 
30 of Boneh), 

the additional signature values are generated by ci+1=H(L ||m || e (Ti, 
P)e(ciH1(IDi), Ppub)), for "i" corresponding to one of values of all modulo n (k+1, .... 
n-1 , 0, 1 , k-1), where Ti is a random value of the cyclic group G (col. 29, lines 1-10 of 
Boneh), 

the ID-based ring signature value, Tk, is calculated by Tk=A-ckSIDk (Figures 10- 
12, elements 1 106. 1 107, col. 30, line 1 through col. 33. line 4 of Boneh), 
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the ID-based ring signature is obtained in a form of a sequence (cO, TO, T1 Tn-1) 

(Figures 10-12, elements 1106, 1107 of Bbneh), and 

the validity of the ID-based ring signature is determined by means of the 
following Equations: 

ck+1 =H(L||m|| e(A,P)) 

ck + 2 = H(L|| mil e(Tk + 1,P)e(ck+1H1(IDk + 1),Ppub)) 

c n = H ( L II m II e ( T n - 1 , P ) e ( 0 n - 1 H 1 ( ID n - 1 ) , P pub ) ) 

c1 = H ( L II m II e ( T 0 , P ) e ( c 0 H 1 ( ID 0 ) , P pub ) ) 

c 2 = H ( L II m II e ( T 1 , P ) e ( c1 H 1 ( ID 1 ) , P pub ) ) 

c k = H ( L II m II e ( T k - 1 , P ) e ( c k - 1 H 1 ( ID k - 1 ) , P pub ) ) 

wherein if i=0, 1 n-1 and cn=cO, then the ID-based ring signature Is accepted to 

be valid; and if otherwise, the ID-based ring signature is rejected (pages 552-565 of 
Rivest). 

Contact Information 

3. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Baotran N. To whose telephone number is 571-272- 
8156. The examiner can normally be reached on Monday-Friday from 8:00 to 4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Y. Vu can be reached on 571-272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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published applications may be obtained from either Private PAIR or Public PAIR. 
Status infonnation for unpublished applications is available through Private PAIR only. 
For more infonnation about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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